0

I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still preventing me from running it. What am I missing to get this to work?

I disabled it by adding DisableAntiSpyware toHKLM/Software/Policies/Microsoft/Windows Defender and setting it to 1. enter image description here

Improve this question
4
  • How is it preventing it? What messages do you see? How do you know it's Windows? Have you looked at the Event Log?
    – Rohit Gupta
    Mar 11 at 4:51
  • Well I initially thought it was windows blocking it, but it is an older sample I am looking at so it just might not work on Windows 8/10/11. I did try Windows 11 and on 11 even with everything off Windows 11 still removes it from the machine. I had to add it to allowed threats. But it does not move itself to another folder like it should. I have a feeling it might just not work correctly on newer OSes.
    – Jason Crosby
    Mar 11 at 13:07
  • I am going to try execute it using wine on my REMnux box.
    – Jason Crosby
    Mar 11 at 13:09
  • It is also not making any network requests like it should.
    – Jason Crosby
    Mar 11 at 13:11

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.